4 ms·

> My own speculation is that this is them warding against extension-takeovers I don't buy that. If they learn that an extension has been taken over, then they

> My own speculation is that this is them warding against extension-takeovers I don't buy that. If they learn that an extension has been taken over, then they can just block the extension. Also, why the domain list? If some extension has started cryptomining, why will Mozilla protect me only when I visit selected domains? And why the tight lips?

unethical_ban 3y ago
[flagged]
kemayo 3y ago
> If they learn that an extension has been taken over, then they can just block the extension. The goal would be to stop compromised extensions from being able to hit high value targets even before anyone has realized they're compromised. They won't get that valuable window in which the malicious update has gone out, but nobody has realized that it was malicious. > If some extension has started cryptomining, why will Mozilla protect me only when I visit selected domains? Because they're not protecting against cryptomining, they're protecting against data theft, which is naturally going to focus on certain high-value domains.
- rst 3y ago
  But if they know there was a malicious update, being distributed through infrastructure they control, why not immediately block it altogether? (The notion that they have an explicit list of every, say, bank, stockbroker, crypto exchange, etc., so they could disable it for only those is... awfully suspect.)
  - kemayo 3y ago
    Because this would block it from hitting some high-value sites before they know there was a malicious update. I would imagine that once they know about it it'd also get added to the blocked-extensions list.
    - JohnFen 3y ago
      The only way this approach could work is if they prevent any extensions from being in force on such websites from day 1. I can't imagine that's their plan unless they really are trying to chase away the few FF users left.
      - kemayo 3y ago
        Per the article, quarantined sites will only allow "monitored" extensions to run. I presume that this means extensions for which they actually do verify that updates are non-malicious, which probably includes most of the popular extensions. Hard to say exactly which -- uBlock was called out as being one in the article, but there's nothing on its addon page[1] specifically flagging it as being on that list. [1]: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...
unethical_ban 3y ago
Alternative headline: "Mozilla enables a global extension enablement policy for greater security" Your solution is reactive. If I install a useful extension but want to ensure it can't access internal or sensitive websites (least privilege, basic cybersecurity) why would I want to wait until Mozilla disables the extension, after it is discovered to be malicious? This seems to provide a user-controllable override of an extension's settings to enhance security, and I'm here for it.

unethical_ban 3y ago

[flagged]

kemayo 3y ago

> If they learn that an extension has been taken over, then they can just block the extension. The goal would be to stop compromised extensions from being able to hit high value targets even before anyone has realized they're compromised. They won't get that valuable window in which the malicious update has gone out, but nobody has realized that it was malicious. > If some extension has started cryptomining, why will Mozilla protect me only when I visit selected domains? Because they're not protecting against cryptomining, they're protecting against data theft, which is naturally going to focus on certain high-value domains.

rst 3y ago
But if they know there was a malicious update, being distributed through infrastructure they control, why not immediately block it altogether? (The notion that they have an explicit list of every, say, bank, stockbroker, crypto exchange, etc., so they could disable it for only those is... awfully suspect.)
- kemayo 3y ago
  Because this would block it from hitting some high-value sites before they know there was a malicious update. I would imagine that once they know about it it'd also get added to the blocked-extensions list.
  - JohnFen 3y ago
    The only way this approach could work is if they prevent any extensions from being in force on such websites from day 1. I can't imagine that's their plan unless they really are trying to chase away the few FF users left.
    - kemayo 3y ago
      Per the article, quarantined sites will only allow "monitored" extensions to run. I presume that this means extensions for which they actually do verify that updates are non-malicious, which probably includes most of the popular extensions. Hard to say exactly which -- uBlock was called out as being one in the article, but there's nothing on its addon page[1] specifically flagging it as being on that list. [1]: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...

unethical_ban 3y ago

Alternative headline: "Mozilla enables a global extension enablement policy for greater security" Your solution is reactive. If I install a useful extension but want to ensure it can't access internal or sensitive websites (least privilege, basic cybersecurity) why would I want to wait until Mozilla disables the extension, after it is discovered to be malicious? This seems to provide a user-controllable override of an extension's settings to enhance security, and I'm here for it.